r-zakarya
370432f638
6c-1 removed the client caller, but the server handler stayed armed: a stray authed+CSRF'd call could still re-encrypt only 1 blob of 8 (data loss) or rewrite a -v2 account's hash_algo (permanent lockout, 6c-4). Gutted the ~165 destructive lines and replaced the body with an auth+CSRF gate then HTTP 410. Both risks are now closed server-side, not merely unreachable by convention. The vestigial kdfMigration login signal is left (client ignores it, endpoint 410s) — removing it would cascade through a login-path param for no benefit. Fixed the now-false comments pointing at migrate-kdf. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
